|
| 1 | +/** |
| 2 | + * Provides support for identifying callables that copy characters from an input string while |
| 3 | + * possibly dropping or replacing some characters. |
| 4 | + */ |
| 5 | + |
| 6 | +import java |
| 7 | +import semmle.code.java.dataflow.DataFlow |
| 8 | + |
| 9 | +private predicate isStringLike(Type type) { |
| 10 | + type.(RefType).getASupertype*().hasQualifiedName("java.lang", "CharSequence") |
| 11 | +} |
| 12 | + |
| 13 | +private predicate isReader(Type type) { |
| 14 | + type.(RefType).getASupertype*().hasQualifiedName("java.io", "Reader") |
| 15 | +} |
| 16 | + |
| 17 | +private predicate isCharacterOutput(Type type) { |
| 18 | + type.(Array).getElementType().(PrimitiveType).hasName("char") |
| 19 | + or |
| 20 | + type.(RefType).getASupertype*().hasQualifiedName("java.lang", "Appendable") |
| 21 | + or |
| 22 | + type.(RefType).getASupertype*().hasQualifiedName("java.io", "Writer") |
| 23 | +} |
| 24 | + |
| 25 | +private predicate occursInLoop(Expr expr, LoopStmt loop) { |
| 26 | + expr.getEnclosingStmt().getEnclosingStmt*() = loop |
| 27 | +} |
| 28 | + |
| 29 | +/** |
| 30 | + * Holds if `read` is a character or code point read from `input` during `loop`. |
| 31 | + */ |
| 32 | +private predicate readsCharacter(Parameter input, LoopStmt loop, Expr read) { |
| 33 | + exists(MethodCall call, VarAccess inputAccess | |
| 34 | + inputAccess.getVariable() = input and |
| 35 | + DataFlow::localExprFlow(inputAccess, call.getQualifier()) and |
| 36 | + call.getMethod().hasName("charAt") and |
| 37 | + read = call and |
| 38 | + occursInLoop(call, loop) |
| 39 | + ) |
| 40 | + or |
| 41 | + exists(MethodCall call, VarAccess inputAccess | |
| 42 | + inputAccess.getVariable() = input and |
| 43 | + DataFlow::localExprFlow(inputAccess, call.getArgument(0)) and |
| 44 | + call.getMethod().hasQualifiedName("java.lang", "Character", "codePointAt") and |
| 45 | + read = call and |
| 46 | + occursInLoop(call, loop) |
| 47 | + ) |
| 48 | + or |
| 49 | + exists(EnhancedForStmt forStmt, MethodCall toCharArray, VarAccess inputAccess | |
| 50 | + loop = forStmt and |
| 51 | + forStmt.getExpr() = toCharArray and |
| 52 | + toCharArray.getMethod().hasName("toCharArray") and |
| 53 | + inputAccess.getVariable() = input and |
| 54 | + DataFlow::localExprFlow(inputAccess, toCharArray.getQualifier()) and |
| 55 | + read = forStmt.getVariable().getVariable().getAnAccess() and |
| 56 | + occursInLoop(read, loop) |
| 57 | + ) |
| 58 | + or |
| 59 | + exists( |
| 60 | + LocalVariableDecl reader, ClassInstanceExpr readerInit, Expr constructorArgument, |
| 61 | + VarAccess inputAccess, MethodCall readCall |
| 62 | + | |
| 63 | + reader.getType() = readerInit.getType() and |
| 64 | + isReader(reader.getType()) and |
| 65 | + reader.getInitializer() = readerInit and |
| 66 | + constructorArgument = readerInit.getAnArgument() and |
| 67 | + inputAccess.getVariable() = input and |
| 68 | + DataFlow::localExprFlow(inputAccess, constructorArgument) and |
| 69 | + readCall.getQualifier() = reader.getAnAccess() and |
| 70 | + readCall.getMethod().hasName("read") and |
| 71 | + read = readCall and |
| 72 | + occursInLoop(readCall, loop) |
| 73 | + ) |
| 74 | +} |
| 75 | + |
| 76 | +/** |
| 77 | + * Holds if a character value can flow from `source` to `sink`. |
| 78 | + * |
| 79 | + * This is deliberately separate from normal taint tracking: character conversion is used only as |
| 80 | + * evidence for inferring a string-level summary. |
| 81 | + */ |
| 82 | +private predicate characterFlowStep(DataFlow::Node source, DataFlow::Node sink) { |
| 83 | + DataFlow::localFlowStep(source, sink) |
| 84 | + or |
| 85 | + exists(MethodCall conversion | |
| 86 | + conversion.getMethod().hasQualifiedName("java.lang", "Character", ["toChars", "toString"]) and |
| 87 | + source.asExpr() = conversion.getArgument(0) and |
| 88 | + sink.asExpr() = conversion |
| 89 | + ) |
| 90 | +} |
| 91 | + |
| 92 | +private predicate characterFlows(Expr source, Expr sink) { |
| 93 | + characterFlowStep*(DataFlow::exprNode(source), DataFlow::exprNode(sink)) |
| 94 | +} |
| 95 | + |
| 96 | +/** |
| 97 | + * Holds if `output` receives a character derived from `read` during `loop`. |
| 98 | + */ |
| 99 | +private predicate writesCharacter(LoopStmt loop, Expr read, Variable output) { |
| 100 | + exists(MethodCall write, Expr value | |
| 101 | + occursInLoop(write, loop) and |
| 102 | + write.getMethod().hasName(["append", "write"]) and |
| 103 | + write.getQualifier() = output.getAnAccess() and |
| 104 | + isCharacterOutput(output.getType()) and |
| 105 | + value = write.getArgument(0) and |
| 106 | + characterFlows(read, value) |
| 107 | + ) |
| 108 | + or |
| 109 | + exists(AssignExpr write, ArrayAccess element | |
| 110 | + occursInLoop(write, loop) and |
| 111 | + write.getDest() = element and |
| 112 | + element.getArray() = output.getAnAccess() and |
| 113 | + isCharacterOutput(output.getType()) and |
| 114 | + characterFlows(read, write.getSource()) |
| 115 | + ) |
| 116 | + or |
| 117 | + exists(AssignAddExpr append | |
| 118 | + occursInLoop(append, loop) and |
| 119 | + append.getDest() = output.getAnAccess() and |
| 120 | + output.getType() instanceof TypeString and |
| 121 | + characterFlows(read, append.getSource()) |
| 122 | + ) |
| 123 | +} |
| 124 | + |
| 125 | +private predicate returnsOutput(Method method, Variable output) { |
| 126 | + exists(ReturnStmt returnStmt | |
| 127 | + returnStmt.getEnclosingCallable() = method and |
| 128 | + returnStmt.getExpr().getAChildExpr*() = output.getAnAccess() |
| 129 | + ) |
| 130 | +} |
| 131 | + |
| 132 | +private predicate characterFilteringOutput( |
| 133 | + Method method, int inputPosition, LocalScopeVariable output |
| 134 | +) { |
| 135 | + exists(Parameter input, LoopStmt loop, Expr read | |
| 136 | + input = method.getParameter(inputPosition) and |
| 137 | + isStringLike(input.getType()) and |
| 138 | + loop.getEnclosingCallable() = method and |
| 139 | + output.getCallable() = method |
| 140 | + | |
| 141 | + readsCharacter(input, loop, read) and |
| 142 | + writesCharacter(loop, read, output) |
| 143 | + ) |
| 144 | +} |
| 145 | + |
| 146 | +/** |
| 147 | + * Holds if a call to a character-filtering method copies data from `input` to `output`. |
| 148 | + */ |
| 149 | +predicate characterFilteringCallStep(DataFlow::Node input, DataFlow::Node output) { |
| 150 | + exists(MethodCall call, int inputPosition, LocalScopeVariable filteredOutput | |
| 151 | + characterFilteringOutput(call.getMethod(), inputPosition, filteredOutput) and |
| 152 | + input.asExpr() = call.getArgument(inputPosition) |
| 153 | + | |
| 154 | + returnsOutput(call.getMethod(), filteredOutput) and output.asExpr() = call |
| 155 | + or |
| 156 | + exists(int outputPosition | |
| 157 | + filteredOutput = call.getMethod().getParameter(outputPosition) and |
| 158 | + output.asExpr() = call.getArgument(outputPosition) |
| 159 | + ) |
| 160 | + ) |
| 161 | +} |
0 commit comments